Sub-processors
Effective 1 October 2026 · Version 2026-10-08
1. Current sub-processors
When we act as a processor for our customers, these providers process personal data to help us deliver the service.
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Amazon Web Services | Application hosting, database and backups | EU / UK (configured region) | All customer data |
| Cloudflare R2 | File and photo storage | EU / global edge | Uploaded files, machine photos, attachments |
| Resend | Transactional email delivery | United States / EU | Names and email addresses, email content |
| Apple Push Notification service / Google Firebase Cloud Messaging / Expo | Mobile and web push notifications | United States | Device tokens, notification text |
| OpenAI | Optional AI assistant and content features (only when used) | United States | Text you submit to the assistant |
| hCaptcha | Abuse prevention on public forms | United States / EU | IP address, browser signals |
| Stripe | Payment processing for subscriptions (when billing is enabled) | United States / EU | Billing contact and payment details |
| RevenueCat / Apple / Google | In-app subscription management on mobile (when enabled) | United States | Account identifier, purchase status |
2. Changes
We will tell account owners at least 30 days before adding or replacing a sub-processor. To receive notice or to object, email privacy@vendset.co.uk.